DATA COLLECTION AND PROCESSING

We only process personal data when necessary to provide a functional and user-friendly website, including its content and services. The processing of personal data follows Article 4 No. 1 of the GDPR and includes collection, storage, adaptation, retrieval, use, or deletion of personal data.

LEGAL BASIS FOR PROCESSING

We process personal data based on:
* Article 6(1)(a) GDPR – Consent (e.g., newsletter registration)
* Article 6(1)(b) GDPR – Performance of a contract or pre-contractual measures
* Article 6(1)(f) GDPR – Legitimate interest (e.g., website security, analytics)

SERVER LOG DATA

When visiting our website, your browser automatically transmits the following data to our server:
* Browser type and version
* Operating system
* Referrer URL (previously visited page)
* Date and time of access
* IP address
This data is stored for security reasons and to ensure the stability of our website. It will be automatically deleted after seven days, unless further storage is required for legal or security reasons.

COOKIES

Our website uses cookies to improve usability and website performance. Cookies are small text files stored on your device.
Session Cookies
* Temporary cookies that are deleted when you close your browser.
* Used for basic website functionality (e.g., navigation).
Third-Party Cookies
We may use third-party cookies for analytics, advertising, or improving our services. You can disable cookies in your browser settings, but this may affect website functionality.
More information on managing cookies: Browser Support.

MAILCHIMP NEWSLETTER

We use MailChimp to manage our newsletter subscriptions. If you subscribe, we process:
* Your email address (required)
* Your name (optional)
* Your IP address & subscription timestamp
Our newsletters may include tracking technologies (web beacons) to analyze engagement. You can unsubscribe at any time via the link in the newsletter.
For more details: MailChimp Privacy Policy.

GOOGLE ANALYTICS

We use Google Analytics to analyze website traffic. Google may collect:
* Your IP address (anonymized within the EU)
* Your device/browser details
* Your location and interactions on our site
You can opt out of Google Analytics tracking via the Google Analytics Opt-out Add-on.
For more details: Google Privacy Policy.

INSTAGRAM INTEGRATION

We use Instagram to promote our exhibitions and engage with visitors. If you interact with our Instagram profile, your data may be processed by Meta Platforms Ireland Ltd.
For more details: Instagram Privacy Policy.

DATA SECURITY

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse. However, no online transmission is 100% secure. If you suspect any security breaches, please contact us immediately.

YOUR RIGHTS UNDER GDPR

As a user, you have the following rights regarding your personal data:
1. Right to Access (Art. 15 GDPR) – Request a copy of your data.
2. Right to Rectification (Art. 16 GDPR) – Correct inaccurate or incomplete data.
3. Right to Erasure (Art. 17 GDPR) – Request deletion of your data.
4. Right to Restriction of Processing (Art. 18 GDPR) – Request limited processing of your data.
5. Right to Data Portability (Art. 20 GDPR) – Receive your data in a structured format.
6. Right to Object (Art. 21 GDPR) – Object to processing based on legitimate interest.
7. Right to Withdraw Consent (Art. 7(3) GDPR) – Withdraw your consent at any time.
If you have any questions, email us at: info.boundingbox@gmail.com

FIREBASE

Public Comments When you post a comment, we store the message along with a timestamp using Firebase Firestore (Google). Comments are anonymous and do not require login. Your IP address may be logged by Google for security purposes. For more details, see the Firebase Privacy and Security page.

Bounding Box reserves the right to update this Privacy Policy at any time. Please check this page periodically for updates.